Bastion

Fetch the authenticated customer's Bastion profile: company name, website, and basic account metadata. Use this when the user asks about their own company record in Bastion, or when another tool needs the customer's website or company name as input.

get-customer

Get the aggregate compliance posture for every framework the customer is tracking (e.g. SOC 2, ISO 27001, HIPAA): total tests, pass/fail counts, and overall percentage per framework. Use this as the entry point when the user asks about overall compliance status, a single framework's completion, or which framework needs the most attention.

get-frameworks-stats

Check the status of the customer's compliance knowledge base. Returns status (not_created, refreshing, ready), last refresh timestamp, and whether it's stale (>7 days old). Always call this before asking questions to ensure the knowledge base is ready.

get-knowledge-base-status

Get open code security issues (SAST findings) from Bastion, filtered by criticality. Returns only key fields: id and the repoName of each evidence. Results are paginated (default 25 per page, max 100). Compare totalCount against the returned items and call again with a higher page to fetch more.

list-code-security-issues

List the latest version of every customer policy (metadata only — no body content). Returns key fields per policy: policyId, version, category, type, status, filename. Use get-customer-policy-by-id to fetch the full text of a specific policy by policyId. Bodies are intentionally omitted here to keep the response within model context limits.

list-customer-policies

Get the list of failing compliance tests for a given framework, optionally filtered by test type (manual/automatic) and integration. Use this after get-compliance-failing-summary to drill into a specific integration/type combination. Returns only key fields: id, testId, name, testResultStatus, type, category. Results are paginated (default 25 per page, max 100). Compare totalCount against the returned items and call again with a higher page to fetch more.

list-failing-compliance-tests

Record how a Bastion security issue is being handled by assigning it a remediation state (for example: accepted risk, false positive, or resolved) together with a required justification comment. Use this when the user has reviewed a specific code security issue and wants to change its remediation status. The remediation is reversible — it can be updated to a different state later.

post-customer-issues-remediation

Trigger a refresh of automatic compliance tests for a given integration. Use this after the user has fixed an issue in an external system (e.g. enabled branch protection on GitHub) to re-check the test status. Returns immediately — the refresh runs asynchronously.

refresh-compliance-test

Trigger a refresh of the customer's compliance knowledge base. This is an asynchronous operation that takes approximately 10 minutes to complete. The knowledge base indexes all customer policies, controls, questionnaires, company information, and compliance documents. Use get-knowledge-base-status to check when refresh is complete.

post-knowledge-base-refresh

Get a presigned URL to upload a document (PDF, screenshot, image) directly to the compliance system. Use this for any real file — it avoids having to inline the file's base64 (which is too large to pass as a tool argument). Returns an `uploadUrl`, the `requiredHeaders` to send with it, and an `uploadId`. Next steps: (1) upload the local file to `uploadUrl` with an HTTP PUT, sending the `requiredHeaders` — e.g. in a shell: `curl -X PUT --upload-file "<localPath>" -H "Content-Type: <contentType>" "<uploadUrl>"`. (2) call upload-compliance-document with the returned `uploadId` to register the document and get its id. Supported formats: PDF, PNG, JPG, XLSX, DOCX, CSV. Max size: 25 MB.

request-document-upload

Submit a compliance test for Bastion admin review. Use this after adding evidence to a manual test to move it from 'fail' to 'ready_for_bastion_review' status. Once reviewed and approved by a Bastion admin, the test will count as passing.

mark-compliance-test-ready-for-review

Get a summary of failing compliance tests grouped by integration and test type (manual/automatic) for a given framework. Use this after get-frameworks-stats to understand where failures are concentrated.

get-compliance-failing-summary

Update the customer's Trust Center configuration: publish/unpublish the page, edit FAQ entries, change the background color, or update SEO head attributes (title, description, keywords). Use this when the user asks to change, publish, or customize their Trust Center page. Call get-trust-center-config first to see the current state so unspecified fields are preserved. Any change made here is visible on the customer's public Trust Center URL.

put-trust-center

Update the status of a compliance admin task (pending / in_progress / done). Marking a task done is only allowed when the task's `markAsDone.enabled` is true — always confirm with the user using the `markAsDone.label` wording first. Tasks without `markAsDone.enabled` complete automatically when the underlying action is performed (e.g. connecting an integration), and tasks `managedBy: "bastion"` are completed by Bastion — neither can be forced done through this tool.

put-compliance-admin-task

Register a document (screenshot, PDF, image) in the compliance system and get a document ID that can be used with add-compliance-test-evidence to attach it as evidence to a test. Provide exactly one of: `uploadId` (preferred — from request-document-upload after PUTting the file to its presigned URL), or `document` (an inline base64 string with MIME prefix, e.g. 'data:image/png;base64,...'; only practical for tiny files). Supported formats: PDF, PNG, JPG, XLSX, DOCX, CSV. Max size: 25 MB.

upload-compliance-document